fix(node): prevent OAuth tests from launching browsers (#4196)

OAuth tests set `LANCEDB_OAUTH_BROWSER` inside Jest's sandbox, which
does not update the process environment read by Rust. As a result, the
native login flow launches a real browser; the [failing macOS main
job](https://github.com/lancedb/lancedb/actions/runs/35067074667/job/104699667840)
ends by terminating an orphaned Safari process.

Set the no-op browser helper while loading Jest configuration, before
creating sandboxes and workers, so both local and CI tests inherit it.
Check the inherited process environment before OAuth login to catch
regressions without opening a browser. Windows uses a no-op command
fixture. Test deadlines and worker counts are unchanged.

A negative control restoring the sandbox-only assignment fails in the
new pre-login check. The full macOS test suite passes with the standard
test launcher; the Windows helper has not been executed locally. The
[first hosted macOS
run](https://github.com/lancedb/lancedb/actions/runs/35071525843/job/104713928139)
passes all 843 tests (5 skipped), with no Safari process in the job log.
Further normal runs are needed to establish sustained stability.

nodejs/__test__/fixtures/oauth_browser.cmd

@@ -0,0 +1,3 @@
+@rem SPDX-License-Identifier: Apache-2.0
+@rem SPDX-FileCopyrightText: Copyright The LanceDB Authors
+@exit /b 0

nodejs/__test__/oauth.test.ts

@@ -3,6 +3,7 @@
 
 import * as fs from "fs";
 import * as http from "http";
+import { execFileSync } from "node:child_process";
 import * as os from "os";
 import * as path from "path";
 import { OAuthConfig, OAuthFlowType, OAuthSession } from "../lancedb/oauth";
@@ -23,9 +24,15 @@ function deviceConfig(issuerUrl: string, cacheDir: string): OAuthConfig {
 
 describe("OAuthSession", () => {
   beforeAll(() => {
-    // Point the Rust browser helper at a no-op so device-flow logins never
-    // open a real browser window during tests.
-    process.env.LANCEDB_OAUTH_BROWSER = "/usr/bin/true";
+    // Child processes inherit the real environment, just as Rust reads it.
+    // Fail before login if the browser override only exists in Jest's sandbox.
+    const browser = execFileSync(
+      process.execPath,
+      ["-p", "process.env.LANCEDB_OAUTH_BROWSER ?? ''"],
+      { encoding: "utf8" },
+    ).trim();
+    expect(browser).not.toBe("");
+    expect(browser).toBe(process.env.LANCEDB_OAUTH_BROWSER);
   });
 
   it("reports an absent session and logout is idempotent", async () => {